PT-2016-3276 · Apache+3 · Apache Commons Fileupload+4

Published 2016-10-17 · Updated 2024-05-27 · CVE-2016-1000031

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Commons FileUpload versions prior to 1.3.3

Description The issue is related to the deserialization mechanism in the DiskFileItem class of the Apache Commons FileUpload library. It allows a remote attacker to execute arbitrary code or manipulate files in the target system using specially crafted data. The vulnerability can be exploited by sending a specially formed Java Object, enabling the attacker to write or copy files to arbitrary disk locations and execute arbitrary code.

Recommendations For versions prior to 1.3.3, update to version 1.3.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the DiskFileItem class until a patch is available.

Fix

RCE

Improper Access Control

Deserialization of Untrusted Data

Weakness Enumeration

CWE-284

CWE-502

Related Identifiers

ALT-PU-2017-3595

BDU:2018-01429

CVE-2016-1000031

GHSA-7X9J-7223-RG5M

OPENSUSE-SU-2019:1399-1

OPENSUSE-SU-2019_1399-1

SUSE-SU-2019:1212-1

SUSE-SU-2019:1212-2

SUSE-SU-2019:1214-1

SUSE-SU-2019:14044-1

SUSE-SU-2019_1212-1

SUSE-SU-2019_1212-2

SUSE-SU-2019_1214-1

SUSE-SU-2019_14044-1

ZDI-16-570

Affected Products

Alt Linux

Apache Commons Fileupload

Apache Struts

Debian

Suse

References · 64

• https://zerodayinitiative.com/advisories/ZDI-16-570 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-1000031 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1000031 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1399-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000031 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:14044-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7x9j-7223-rg5m · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:1212-1 · Vendor Advisory
• https://issues.apache.org/jira/browse/FILEUPLOAD-279 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1000031 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-1000031 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:1212-2 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-3595 · Vendor Advisory